As methods and devices for engaging in financial transactions have increased, old problems of protecting sensitive information persist. For example, one common source of fraud occurs when a hacker gains access to a data center and obtains sensitive information such as credit card numbers and other cardholder data. As another example, an employee entrusted to maintain sensitive information can provide a fraudster access to the cardholder data, either by voluntary act, trick, negligence, or accident.
To protect sensitive information from such fraud, a data center may encrypt the data it stores. For example, a merchant may wish to track financial transactions at one or more stores to gain insight on the purchasing tendencies of its customers. In this example, the merchant may store financial information (e.g., credit card numbers) associated with the purchases. However, because such information is sensitive and could be used to conduct fraudulent transactions, the merchant may secure the credit card numbers it collects by encrypting the credit numbers it stores in its data center.
A merchant processor that performs payment gateway services on behalf of a merchant is another example of a data center. For example, the merchant processor (as provided by CYBERSOURCE™, of Mountain View, Calif.), may receive payment information from a merchant computer, process the payment information into the format of an authorization request message, send the authorization request message to the appropriate payment processing network (as may be offered by VISA™), receive an authorization response message, and route the authorization response message back to the merchant computer so that the merchant can provide a good or service to a customer.
Other examples of data centers include acquirers and acquirer processors. An acquirer is typically a business entity (e.g., a commercial bank) that has a business relationship with a particular merchant. Acquirers may facilitate and manage financial transactions on behalf of merchants. An acquirer processor is typically a transaction processing entity that has a business relationship with a particular acquirer. Acquirer processors may provide merchants with transaction clearing, settlement, billing and reporting services.
In addition to the payment services described above, the acquirer or acquirer processor can also provide a variety of financial reports to the merchants registered for its services. For example, once a transaction has completed, the merchant may request information specifically for that transaction by sending a report request message to the acquirer or acquirer processor. The acquirer or acquirer processor may respond to the report request message by sending full payment information related to the specified transaction to the merchant.
To provide full payment information back to the merchant as part of these financial reports, the acquirer or acquirer processor may store the credit card numbers involved in the transactions. Accordingly, the acquirer or acquirer processor can be a form of a data center that stores cardholder information and other sensitive information. For the reasons described above, the acquirer or acquirer processor may protect the cardholder information against potential fraudsters. In one approach, the acquirer or acquirer processor may encrypt the credit card numbers that it receives. Further, to avoid collisions between the credit card numbers, the acquirer or acquirer processor may use an encryption key specific to each merchant when the acquirer or acquirer processor encrypts an account number, for example.
When a data center (e.g., a merchant processor, merchant, acquirer processor, or acquirer) maintains a database of sensitive information, the data center may have to comply with a number regulations. Such regulations attempt to increase controls around cardholder data to reduce credit card fraud via its exposure. For example, the Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards. As part of the PCI DSS, a data center that stores and/or processes cardholder information must ensure that the cardholder data is secured. Further, the data center must perform periodic compliance testing.
As described above, a data center may encrypt cardholder information to comply with the PCI DSS. There are many known methods of encryption. Comparatively secure encryption systems are typically expensive and may consume large portions of a computer system's processing bandwidth.
Embodiments of the invention address the above problems, and other problems, individually and collectively.